That's not the risk. The risk is that Github has lackluster permissions and audit trailing and an employee could leak and sell keys. Or that they log keys and someone hacks their logs.

Rotating the secret is 100% the correct thing to do in this case.

I’m not that worried about this. I mean, Microsoft runs azure and they have security protocols, that you can audit and show to your auditors, that reduce the risk of sysadmins snooping on vms, blob storage and anything else they could scan for keys.

I think the risk of a GitHub employee introducing malicious code to scan memory and dump any tokens found for exhilaration is lower than the risk of my own employee or myself doing that.

Rotating the secret seems like a waste of resources in this situation.

Yeah definitely better than allowing the push. But I feel they should also at least recommend rotating the secret

My team checked out the similar thing they're pushing in ADO (https://learn.microsoft.com/en-us/azure/defender-for-cloud/a...). The messages from that thing do tell you to rotate, though AFAIK not having looked that far into it just breaks the build, not proactive push detection.